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(54) SUPPORT METHOD FOR GUARANTEEING OPERATION OF SYSTEM 

(57)Abstract: H * 

PROBLEM TO BE SOLVED: To guarantee the operating 
property of communication or the like in a network 
system by suppressing the spreading of a computer 
virus even though no virus-disinfection tool is 
distributed. 

SOLUTION: When a computer virus spreads, 'pass 
rejection' is stored in access control information 53 for a 
destination service number 1002 used by the computer 
virus in a communication packet as switching of access 
control of a pass service (S1406), and 'pass permission' 
is stored in access control information 55 for a 
substitute service number 54 ($1407). Thereby, the 
communication packet of the computer virus is 
interrupted and the communication packet of the 
substitute service number is filtered out. 'Substitute' 
showing selection of the substitute service number as a 
service number used by a normal application program is 
stored in service selection 74 as a switching operation 
to a substitute service (S1409). By doing this, a 
substitute service number 73 subjected to the 'pass permission' is thereafter used to perform 
communication. 
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5 [0006] 

[Means for solving problem] The present invention is 
achieved by the means explained below as a support method 
for guaranteeing system operation for a network system that 
is configured with equal to or more than one device using 
10 an electronic calculator for solving the above problem. 

(1) Detecting abnormal traffic 

Traffic generated by a computer virus such as a worm 
is detected. Traffic is identified when a traffic 
pattern that differs from a normal mode is generated 
15 exceeding a threshold value or from initial analytical 

information concerning a computer virus. 

(2) Switching destination service number 

A destination service number used by the traffic that 
is detected at the first step is switched to a 
20 substitute service number that is used when a computer 

virus spreads. 

(3) Switching access control of pass service 

Traffic with the substitute service number selected at 
the second step is only allowed to pass and traffic 
25 with the destination service number detected at the 

first step is blocked. 
[0007] Even if. a computer virus such as a worm spreads 
in a targeted network system, these means allows 
suppressing such spreading and ensuring operability of the 
30 system. 

[0008] According to the support for guaranteeing system 
operation of the present invention, only switching the 
support apparatus for guaranteeing system operation to a 
substitute service mode enables blocking the traffic 
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related to a computer virus such as a worm and allows 
passing only the traffic used by an authorized application. 
Accordingly, even if a disinfection tool against a computer 
virus is not distributed, spreading of the computer virus 
5 can be suppressed, and operability of the communication in 
a network system can be ensured. 
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